Dozens of organizations fall victim to infostealers after failing to enforce MFA

World Password Day 2025.

• Hacker “Zestix” (aka Sentap) is auctioning stolen data from 50 global enterprises, including Deloitte, KPMG, Samsung, and Pickett & Associates
• Victims lacked MFA and had devices compromised by infostealers like RedLine, Lumma, or Vidar, enabling credential theft
• Poor password hygiene and years-old credentials allowed large-scale exfiltration; Pickett alone lost ~139 GB of sensitive files

Someone is auctioning a wide range of highly sensitive data, picked up from 50 global enterprises, on the dark web. Among the victims are a couple of real heavy hitters, such as Pickett & Associates, Deloitte, KPMG, and Samsung.